# Indicators of Compromise (lab)

> You are handed a threat feed and a week of proxy logs. Four indicators match, but three are worthless and a second compromised host matches nothing at all.

Canonical: https://codelivly.com/labs/ioc-analysis

| | |
|---|---|
| Type | Investigation |
| Difficulty | Beginner |
| Points | 200 |
| Session length | 30 min |
| Completions | 5 |

You are handed a threat feed and a week of proxy logs. Four indicators match, but three are worthless and a second compromised host matches nothing at all.

## Objective

Learn to judge a feed hit by its last_seen, confidence and source rather than escalating it blind, and to pivot from a confirmed compromise onto a non-infrastructure artefact to find hosts no indicator could ever surface.

## Tasks

1. Match the feed and count host breadth
2. Dismiss the weak hits with grounds
3. Confirm the true positive
4. Pivot on the behavioural artefact

## Related

- [All labs](https://codelivly.com/practice?type=lab)